Basic AACP framing info

[vulpes2]

Apple has renamed the protocol to AACP, still don't know what it stands for, maybe Apple Audio Configuration Protocol? Either way, here's the basic framing info for the AACP messages.

An AACP packet has a u16 type field, a u16 service ID field, and a payload. The service ID is always 4 after the connection has been established, other service IDs have not been observed so far.

There are five packet types:

• 0: Connect, payload: u16 major, u16 minor, u64 features
• 1: Connection Response, payload: u16 status, u16 major, u16 minor, u64 features
• 2: Disconnect, payload: u16 status
• 3: Disconnection Response, no payload
• 4: Message, payload: u16 opcode, payload

Payload for the AACP message packet varies depends on the opcode, they are either fixed size or will have a size field somewhere. For example, opcode 0x9 is a configuration message with a fixed payload of 5 bytes. The first byte is the configuration type, and the following 4 bytes are the values. Not all settings use all the 4 bytes, most will leave the unused bytes as 0x00.

More docs will follow in a few weeks, I just don't have time to write them yet. Handoff seems to be iCloud related and probably beyond my capabilities to figure out, most of my efforts so far have been centered around parsing all the AACP messages I can capture.

[steam3d]

AACP behaves differently depending on which capabilities are supported by the AirPods or Beats. Some Beats headphones do not have an infrared sensor; I noticed that on such headphones you can't control ANC. I suppose the iPhone sends different initialization packets, but the handshake message remains the same.

The interesting thing AirPods and Beats headphones does not notify some own settings intead of it the iPhone override settings during L2CAP connection and when you connect AirPods to iPad, the iPad will also override settings inside AirPods.

You can easily check this. Set up different settings for the 'Press and Hold' feature on the iPhone and iPad, and connect an Android phone after the iPhone. Try to switch between ANC modes and repeat the same with the iPad. You will notice that the settings are always overridden

[vulpes2]

That's consistent with the behavior I've seen so far. When connecting with my python script, the AirPods reports only a subset of the current settings, not sure if there is a way to dump all the current configuration. There also seems to be some certificate exchange stuff, which is probably for checking fake AirPods. The AirPods Pro seems to report its SN after the connection has been established without any special requests, but the original AirPods does not.

[steam3d]

Some fake AirPods also send firmware info and serial numbers. It depends on how good the replica is